WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by tiborisaak in WordPress Plugin Forminator versions = 1.57.2...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

WordPress Forminator cross-site scripting vulnerability

WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...

CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

CVE-2026-28143

Forminator plugin for WordPress is affected by CVE-2026-28143: unauthenticated XSS in versions up to and including 1.56.0. The vulnerability arises in the plugin code path handling input that can be crafted by an attacker without authentication. Impact, as described in the sources, is Cross Site ...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...

CVE-2026-57814 WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through = 1.55.0.1...

CVE-2026-56071

CVE-2026-56071 affects WordPress Forminator plugin versions

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass vulnerability

Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass vulnerability discovered by Kittipat Jitphonchana in WordPress Plugin Forminator versions = 1.52.0...

CVE-2026-32409 WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through = 1.50.2...

PT-2026-25255

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through = 1.50.2...

WordPress Forminator Forms Code Issue Vulnerability

WordPress Forminator Forms is a powerful free form builder plugin that supports the creation of many types of interactive forms. WordPress Forminator Forms suffers from a code issue vulnerability that stems from deserializing untrusted inputs in the function entrydeleteuploadfiles, which can be...

CVE-2024-3053

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminatorform shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it...

WordPress Forminator plugin <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'limit' vulnerability discovered by Asaf Mozes in WordPress Plugin Forminator versions = 1.42.0...

WordPress Forminator plugin <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Forminator versions 1.39.2...

WordPress Forminator Forms plugin <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation vulnerability

Cross-Site Request Forgery to Draft Quiz Creation vulnerability discovered by Vijaysimha Reddy vijaysimha in WordPress Plugin Forminator versions = 1.35.1...

WordPress Forminator Plugin <= 1.35.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Forminator Type Plugin Vulnerable versions = 1.35.1 Fixed in 1.36.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9351 Patch priority Low CVSS severity Low 4.3 Developer WPMU DEV PSID 842f218e0ebe Credits Vijaysimha Reddy vijaysimha...

WordPress Forminator Plugin <= 1.35.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Forminator Type Plugin Vulnerable versions = 1.35.1 Fixed in 1.36.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9352 Patch priority Low CVSS severity Low 4.3 Developer WPMU DEV PSID 2a09c8737b42 Credits Vijaysimha Reddy vijaysimha...

WordPress Forminator plugin <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure vulnerability

HubSpot Developer API Key Sensitive Information Exposure vulnerability discovered by Sean Murphy in WordPress Plugin Forminator versions = 1.29.1...